> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit iam custom owner roles in use remediation ### Triage and Remediation ### Remediation To remediate the "Custom Owner Roles In Use" misconfiguration in Azure using the Azure console, follow these steps: 1. Log in to the Azure portal at [https://portal.azure.com/](https://portal.azure.com/). 2. In the left-hand menu, click on "Azure Active Directory". 3. Click on "Roles and administrators". 4. In the "Roles and administrators" page, click on "Custom roles". 5. Review the custom roles that are currently in use. 6. Identify any custom roles that are assigned to users or groups that have owner-level permissions. 7. Determine if the custom role is necessary for the user or group to perform their job duties. 8. If the custom role is not necessary, remove the role assignment. 9. If the custom role is necessary, modify the permissions of the role to reduce the level of access granted. 10. Repeat steps 6-9 for each custom role that is assigned to users or groups with owner-level permissions. By following these steps, you can remediate the "Custom Owner Roles In Use" misconfiguration in Azure using the Azure console. # To remediate the "Custom Owner Roles In Use" misconfiguration in Azure using Azure CLI, follow the steps below: 1. Open the Azure CLI command prompt or terminal. 2. Run the following command to list all the custom owner roles in use: ``` az role assignment list --all --include-classic-administrators --query "[?roleDefinitionName=='Owner']" ``` This command lists all the custom owner roles in use in your Azure subscription. 3. Review the output of the above command and identify the custom owner roles that are not required or are no longer in use. 4. Run the following command to delete the custom owner role: ``` az role assignment delete --assignee --role ``` Replace `` with the object ID of the user or group to whom the custom owner role is assigned, and `` with the name of the custom owner role. 5. Repeat step 4 for all the custom owner roles that are not required or are no longer in use. 6. Run the following command to verify that the custom owner roles have been deleted: ``` az role assignment list --all --include-classic-administrators --query "[?roleDefinitionName=='Owner']" ``` This command should not list any custom owner roles. By following the above steps, you can remediate the "Custom Owner Roles In Use" misconfiguration in Azure using Azure CLI. To remediate the misconfiguration "Custom Owner Roles In Use" in Azure using Python, you can follow the below steps: Step 1: Connect to Azure using Python SDK ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.resource import ResourceManagementClient credential = DefaultAzureCredential() subscription_id = 'your_subscription_id' client = ResourceManagementClient(credential, subscription_id) ``` Step 2: Get the list of resource groups ```python theme={null} resource_groups = client.resource_groups.list() ``` Step 3: For each resource group, check if custom owner roles are assigned ```python theme={null} for rg in resource_groups: roles = client.role_assignments.list_for_resource_group(rg.name) for role in roles: if role.role_definition_name == 'Owner' and role.scope == rg.id: print(f"Custom Owner role assigned in Resource Group {rg.name}") ``` Step 4: Remove the custom owner role assignments ```python theme={null} for rg in resource_groups: roles = client.role_assignments.list_for_resource_group(rg.name) for role in roles: if role.role_definition_name == 'Owner' and role.scope == rg.id: client.role_assignments.delete(role.scope, role.name) print(f"Custom Owner role removed from Resource Group {rg.name}") ``` Note: Before running the script, make sure to authenticate with Azure using the appropriate credentials and provide the necessary permissions to the service principal or user account. Also, test the script in a non-production environment before running it in a production environment. ```hcl theme={null} resource "azurerm_role_definition" "custom_least_privilege_role" { name = "CUSTOM_ROLE_NAME" # replace with your custom role name scope = "/subscriptions/SUBSCRIPTION_ID" # replace with your subscription ID description = "Least-privilege custom role instead of owner-level access" permissions { actions = [ # Replace this list with the specific management-plane actions actually required, # e.g. "Microsoft.Resources/subscriptions/resourceGroups/read", # "Microsoft.Compute/virtualMachines/start/action", # "Microsoft.Compute/virtualMachines/read", ] not_actions = [] data_actions = [ # Replace with only the specific data-plane actions needed, or leave empty if none. ] not_data_actions = [] } assignable_scopes = [ "/subscriptions/SUBSCRIPTION_ID", # same as above ] } ``` Replace any existing `azurerm_role_definition` that currently uses owner-level permissions (for example, `actions = ["*"]` and/or `data_actions = ["*"]`) with a definition like the above that lists only the minimal required actions; this removes the “custom owner” behavior while keeping a custom role. This change updates the role definition in-place and does not force replacement of the subscription or other resources, but it will immediately reduce the permissions granted to any assignments of this role. For verification, `terraform plan` should show the existing `azurerm_role_definition` changing its `permissions.actions` (and possibly `data_actions`) from wildcard owner-level permissions to the new, restricted list, with no `create` or `destroy` of other resources.